0

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A?

The hypothetical scenario where this might be useful to an attacker is a drive-by install (or any othe kind of) attack where the attacker subsequently redirects the user to the site they were expecting to not draw unnecessary attention. I know there are ways to redirect using JavaScript that would fit this situation, but the question is - can HTTP redirects be used for the same purpose?

2 Answers 2

3

Looking at a single HTTP response with status code 302 can not be used to make any assumptions about previous communication with the site, including no assumptions about the existence or the content of previous HTTP responses from the site. It is even possible that the same requests sometimes serves content and other times results in a 302 redirect.

As for returning script within the same response as the 302: The status code by itself might not be sufficient information for this. I think one can rely on common browsers not executing the body of the response if they actually do a redirect. But a server can send a HTTP response with code 302 which does not cause a redirect, for example by omitting the Location header.

For example Google Chrome will happily execute code in a HTML response served with status code 302 and a missing Location header. By combining this with a script based redirect one can make it look like a redirect was caused by status code 302, but still execute code before the redirect:

HTTP/1.1 302 ok
Content-type: text/html

<script>
  alert("foo");                       // some malicious code here
  location.href="http://example.com"; // redirect
</script>
2
  • From your response, I realised I framed my question poorly - it should have been "Can more content (such as JavaScript) be served as part of a single HTTP 302 response?" Could I ask for more clarification on that? Jan 17, 2022 at 18:38
  • 1
    @MartyCagas: see updated answer Jan 17, 2022 at 19:28
1

There is no such guarantee. It depends on the browser implementation.

See the RFC:

The 302 (Found) status code indicates that the target resource
resides temporarily under a different URI.

This means that the response body should not contain the expected resource.

But actually there is no explicit restriction for the body. The only statement about the body is following:

The server's response payload usually contains a short hypertext note with a hyperlink to the different URI(s).

Thus body doesn't have to be empty and technically can contain also JavaScript. Firefox, Chrome, Edge don't interpret the body. But there are many browsers based on the same code. For instance, these are the most known browsers based on Chromium. There is no guarantee that every browser keeps the logic for HTTP 302 unchanged.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .